Privacy policy.

Who we are

The controller of personal data collected on this site is Satchelpay UAB, reg. No. 304628112, registered at Upės St. 21-1, LT-08128 Vilnius, Lithuania. Satchelpay UAB holds electronic money institution licence No. 28, issued by the Bank of Lithuania. Satchel is an EMI, not a bank. Our data protection officer is reachable at dpo@satchel.eu.

This policy covers this site and the sandbox only — the landing page, the waitlist, and the seeded sandbox API behind it. The regulated e-money service — real accounts, real payments, full onboarding — is a separate processing activity covered by the satchel.eu privacy policy. If you become a live client, that policy applies to your account; this one applies to what happens here before that.

What we collect

Two things, and only when you give them to us or connect to us:

• Waitlist data. The form has one field: your email address. When you submit it we store the email, which track you chose (sandbox key or a manager callback), a timestamp, and the sandbox key we issued you. That record lives in a file on our server (waitlist.json) — not in a marketing platform, not in a CRM.
• Server logs. Like any web server, our hosting infrastructure logs requests — IP address, user agent, requested URL, time. We use these to keep the service running and to prevent abuse, nothing else.

That is the complete list. There is no third-party tracking, no ad pixels, no profiling.

What we do not collect

Everything the sandbox shows your assistant — accounts, IBANs, balances, cards, transactions — is synthetic seed data. It is not your personal data, not your financial data, and not anyone's real money. Asking the sandbox "what's my balance" discloses nothing about you, because the balance isn't yours.

This site also runs no language model and sends nothing to one. Your own assistant — Claude, Cursor, whatever you connect — calls our MCP server, and the data the tools return flows into that assistant's context under your agreement with your AI provider. We never forward your data to an LLM ourselves; we are the API on the other end of your assistant's call.

Purposes and legal bases

• Waitlist — to issue your sandbox key, and to contact you about live API access (or have a personal manager reach out, if you asked for one). Legal basis: your consent (GDPR art. 6(1)(a)), given when you submit the form. You can withdraw it at any time — see below.
• Server logs — to operate the site securely and prevent abuse of the sandbox and the waitlist. Legal basis: our legitimate interest (GDPR art. 6(1)(f)) in running a service that isn't on fire.

We do not use your data for automated decision-making, and we do not send marketing.

How long we keep it

Waitlist entries are kept until live API access ships and we have contacted you — or until you ask us to delete you, whichever comes first. Joining the waitlist is not an account application and creates no entitlement; live accounts are opened separately by a personal manager with full onboarding under satchel.eu terms. Server logs are kept for the short rotation period of our hosting infrastructure and then discarded.

Who we share it with

Our hosting infrastructure providers process data on our behalf as a technical necessity — the server your request hits has to be somewhere. That is the only category of processor. We do not sell personal data, we do not share it with ad networks, and no analytics vendor receives it because we use none.

Your rights

Under the GDPR you can ask us to:

• tell you what data we hold about you (access) and hand it over (portability),
• correct it (rectification),
• delete it (erasure) — for the waitlist this is one email and it's done,
• restrict or object to processing,
• withdraw consent for the waitlist at any time, without affecting past processing.

Email dpo@satchel.eu from the address you signed up with. There is no form to fill in; a plain email is enough. We answer within the GDPR's one-month deadline, usually much faster.

Complaints

If you think we handle your data wrongly and our answer doesn't fix it, you can complain to the supervisory authority: the State Data Protection Inspectorate of Lithuania (VDAI), ada@ada.lt, vdai.lrv.lt. This policy and our processing are governed by the law of the Republic of Lithuania.

Cookies

We set none. No analytics cookies, no marketing cookies, no fingerprinting, no consent banner — because there is nothing to consent to. The sandbox authenticates your assistant with a short-lived session token sent in a request header, not a cookie, and it never touches your browser.

Changes and contact

When this policy changes, we update the date at the top of this page. If a change affects data we already hold about you — the waitlist email — we tell you at that address before it takes effect.

Privacy questions: dpo@satchel.eu. Everything else: support@satchel.eu. Company details and the team are on satchel.eu/about-us; general contact routes on satchel.eu/contact-us.